topic Hi, I also changed timezone in Network Security

[ISE + CDA ] IP Mappings

David Santos — Fri, 21 Feb 2020 13:09:05 GMT

To whom who may help me 🙂

Problem Description: Mapping IP addresses to users are not happening.

Scenario: Two pairs of ISE 1.2 with patch 7 and using a CDA patch 2 in order to map users that do not directly login into Active Directory. I´m using the CDA as a syslog server, receiving the syslog messages from ISE and trying to populates the mapping table.

Tests that i´ve conducted so far:

- Reload the ISE and CDA.

- Changed the security levels of the syslogs

- Removed the Active Directory Servers from CDA so that I could have only one variable, the syslogs messages, to troubleshoot.

- Reconfigured ISE to send the syslog messages to a Solarwinds server to troubleshoot the messages ( at this point so far so good, I can see the messages sent from ISE to the external syslog server )

- Troubleshooted the ports open at CDA and ISE

- Changed from UDP to TCP , and vice versa, the syslog client protocol

- Followed the "Installation and Configuration Guide for Cisco Context Directory Agent, Release 1.0" doc

but nothing that i´ve done to this point I can see the mappings from users to IP addresses. Does anyone have any clue for this?

I´ve attached a couple of screenshoots for you to see!

It sounds like you're setting

Marvin Rhoads — Fri, 04 Apr 2014 15:03:46 GMT

It sounds like you're setting it up correctly.

When you had the AD servers integrated were their authentication events mapped by CDA?

Marvin, when I had the DCs

David Santos — Fri, 04 Apr 2014 15:13:41 GMT

Marvin,

when I had the DCs configured I could see the events mapped in CDA.

Hi David,I also have same

Tural Ahmadov — Fri, 04 Apr 2014 20:17:58 GMT

Hi David,

I also have same problem. In CDA, i recieve syslog from ISE, but log is not include client ip address. Is it same? In log, i receive client name, device ip address (wlc) and other information.

turalahmadov, I can see the

David Santos — Mon, 07 Apr 2014 13:58:45 GMT

turalahmadov,

I can see the messages being parsed but nothing appears in the IP-to-Identity messages!

I'm running in to a similar

ggazanian — Fri, 11 Apr 2014 18:42:59 GMT

I'm running in to a similar issue. I've verified that both authentication passed and radius accounting packets are being received by CDA from ISE, however, nothing ever gets placed in the mappings table. Something to note: when I put logging in to debug mode it shows that the authentication passed messages are parsed, however, the accounting messages are marked as "Incomplete message received, dropped". Has anyone had any luck getting CDA to parse and map the info correctly from ISE?

I´ve opened a case this

David Santos — Fri, 11 Apr 2014 18:45:47 GMT

I´ve opened a case this morning. Let me see what Cisco says about this!

Good luck!

ggazanian — Fri, 11 Apr 2014 20:13:12 GMT

Good luck!

Hi David!I've faced the same

rudenko.alexander — Wed, 16 Apr 2014 21:39:23 GMT

Hi David!

I've faced the same issue against IP-username mapping on CDA.

Have you solved it yet?

Regards,

Nothing so far. I´m waiting

David Santos — Wed, 16 Apr 2014 23:27:26 GMT

Nothing so far. I´m waiting for TAC.

Is anyone having any luck

ggazanian — Thu, 24 Apr 2014 19:17:53 GMT

Is anyone having any luck with TAC or getting this running? I'm still seeing the same issues.

I also have the same issue

rudenko.alexander — Fri, 25 Apr 2014 13:50:49 GMT

I also have the same issue and during tshooting I was pointed to Bug CSCun74460
https://tools.cisco.com/quickview/bug/CSCun74460

It means that mapping could not work due to Timezone issue on ISE side. Looks like ISE sends Radius accounting with incorrect timestamp.
Workaround is switch to non-DayLight Savings Timezone

Interesting... I tried

ggazanian — Fri, 25 Apr 2014 22:00:51 GMT

Interesting... I tried changing the timezone and it corrected the daylight savings issue in that both the CDA and ISE Syslog timestamp offset now much... but it's still not creating the mapping. Did the fix work for you?

Nothing so far from TAC.

David Santos — Sat, 26 Apr 2014 18:48:55 GMT

Nothing so far from TAC. They have captured some log and screenshots and are analysing this issue.

Hi, I also changed timezone

rudenko.alexander — Tue, 29 Apr 2014 07:23:59 GMT

Hi, I also changed timezone and looked through support bundle logs and everything looks ok but mapping still doesn't work.

Does someone have any luck with mapping?

Hi David,Me to in a similar

S Subbiah — Mon, 30 Jun 2014 17:28:49 GMT

Hi David,

Me to in a similar situation , is there any update from TAC on this.? Thanks in advance.

Regards

I´m still troubleshooting

David Santos — Mon, 30 Jun 2014 20:42:04 GMT

I´m still troubleshooting this with TAC.

Hi, CDA checks for the Radius

kushsriva — Wed, 16 Jul 2014 17:24:46 GMT

Hi,

CDA checks for the Radius passed authentication and accounting logs to create a mapping.

1). Make sure the WLC/Switch is sending the accounting logs:

WLC
- radius-server vsa send accounting
- radius-server vsa send authentication

switch
- aaa accounting dot1x default start-stop group radius
- aaa accounting network default start-stop group radius

2). Make sure CDA is added as a syslog and ISE is configured to send passed authentication logs to CDA (as a syslog server).

Do rate if Helpful

Regards,

Kush

Has this been resolved? I

MARK BAKER — Wed, 20 Aug 2014 07:45:30 GMT

Has this been resolved? I have just installed CDA with patches 1, 2, and 3 and have the same issue. I see the username and IP in the syslog parsed by CDA, but don't see it mapped in CDA. The client IP is in FRAMED-IP of the syslog.

Same here...I am waiting on

ingmiguelrosa — Wed, 20 Aug 2014 17:25:16 GMT

Same here...

I am waiting on TAC to let me know if I should install patch 3 to resolve my issue. So far I am running ACS 5.5 with syslogs to CDA and there is no IP-Mappings happening.